77 Commits (e979f6d523449c336f6900a96082b8d5a3143f59)

Author	SHA1	Message	Date
Samaresh Kumar Singh	565e138754	pcap-file: skip setvbuf on non-seekable streams ... Reading a pcap from /dev/stdin or a named pipe currently fails with "failed to get first packet timestamp. pcap_next_ex(): -1" because InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header. On a non-seekable fd glibc cannot recover from that and the next read returns -1. Detect non-regular files via fstat and skip setvbuf in that case so the read keeps working on pipes, fifos and stdin. Accept pcap-file.buffer-size values of 0, which disables setvbuf buffering as an explicit opt-out, or PCAP_FILE_BUFFER_SIZE_MIN (4 KiB) to PCAP_FILE_BUFFER_SIZE_MAX (64 MiB). Treat any non-zero setvbuf return value as an error, not just negative values. When pcap-file.buffer-size fails to parse, retain the default buffer size instead of falling through and setting it to 0. The branches are now mutually exclusive so only one of the parse-error, accepted, or out-of-range messages is logged. Update the user guide: --pcap-file-buffer-size now documents valid values of 0 (disables setvbuf buffering) or 4 KiB to 64 MiB, and pcap-file.rst notes that 0 is the opt-out for non-seekable sources such as stdin and named pipes. Bug: #8464.	5 months ago
jason taylor	da827322ba	doc: minor ebpf doc update for fedora/rhel ... Signed-off-by: jason taylor <jtfas90@proton.me>	5 months ago
Philippe Antoine	64f003190d	doc: move more rules to dedicated css container ... Ticket: 8372 Also remove dead code from script checking the rules	6 months ago
Juliana Fajardini	56917cf8f3	rules: fix typos & missing keywords in examples ... Task #8372	7 months ago
Ofer Dagan	e1f9d8a067	pcap: refactor delete-when-done to support non-alerts ... Refactor pcap file deletion to use a single delete-when-done option with three values instead of separate boolean options: - false (default): No deletion - true: Always delete files - "non-alerts": Delete only files with no alerts Also account for alerts produced by pseudo packets (flow timeout / shutdown flush): - Introduce small capture hooks and invoke on pseudo-packet creation so the capture layer can retain references and observe alerts emitted after the last live packet - Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads Key changes: - Replace should_delete/delete_non_alerts_only bools with enum - Move alert counter from global to per-file PcapFileFileVars - Relocate alert counting from PacketAlertFinalize to pcap module - Ensure thread safety for both single and continuous pcap modes - Add unit tests for configuration parsing and pseudo-packet alert path The --pcap-file-delete command line option overrides YAML config and forces "always delete" mode for backward compatibility. Documentation updated to reflect the new three-value configuration. Fixes OISF#7786	8 months ago
Lukas Sismis	b596073a79	src: doc: remove double-space typos	10 months ago
Victor Julien	365ed2a2ff	af-packet: disable hwtimestamp by default ... Add enable-hwtimestamp option to replace disable-hwtimestamp. Ticket: #7585.	11 months ago
Victor Julien	be2c40bde7	doc/af-packet: document disable-hwtimestamp option ... Ticket: #1954.	11 months ago
Lukas Sismis	897cdb8571	doc/dpdK: update RX/TX descriptor note for Connect-X 4 ... Ticket: 7639	1 year ago
Lukas Sismis	6c654e30ac	threading: support previous threading configuration format ... Provide backward compatibility with the previous configuration format to allow smooth transition to the new format. The commit adds docs about the new format and the introduced changes.	1 year ago
Lukas Sismis	eb52e337da	pcap-file: document capture method options	1 year ago
Lukas Sismis	fbe5ce7a2b	dpdk: document vlan stripping offload ... Ticket: 5838	2 years ago
Lukas Sismis	640d0985c2	dpdk: check for link up before full startup ... ICE card (Intel E810) was not receiving packets immediatelly after startup, Suricata workers would act as processing while it was not. This eliminates the problem by only continuing in the initialization if the link is already up. The setting can be turned off manually from the configuraiton file. Ticket: 7381	2 years ago
Lukas Sismis	2ef2a9e26f	dpdk: auto configure Rx/Tx descriptors and mempool size ... Ticket: 7380 Ticket: 7373	2 years ago
Jason Ish	374762d202	af-packet: remove use-mmap option ... This option is obsolete and was not used in 7.0 as tpacket-v1 support was removed (see ticket #4796).	2 years ago
Lukas Sismis	521d1cb8e7	doc: update eBPF compilation instructions ... Ticket: #6599	2 years ago
Lukas Sismis	2a2898053c	dpdk: add interrupt (power-saving) mode ... When the packet load is low, Suricata can run in interrupt mode. This more resembles the classic approach of processing packets - CPU cores run low and only fetch packets on interrupt. Ticket: #5839	3 years ago
Lukas Sismis	ca6f7c2d00	dpdk: rework hugepage hints to use per-numa information ... Previous integration of hugepage analysis only fetched data from /proc/meminfo. However this proved to be often deceiving mainly for providing only global information and not taking into account different hugepage sizes (e.g. 1GB hugepages) and different NUMA nodes. Ticket: #6419	3 years ago
Ralph Eastwood	9865164e75	napatech: update docs to remove hba reference	3 years ago
Lukas Sismis	11c3aa868d	doc: add DPDK Bond PMD docs ... Ticket: #6099	3 years ago
Victor Julien	c0d9b3c078	doc/userguide: spelling	4 years ago
John Dewey	365bec3da6	netmap: Correct LB + Netmap YAML usage ... Corrected the example YAML configuration when using Netmap and LB.	4 years ago
Richard McConnell	b39a4c63fe	doc: document AF_XDP feature	4 years ago
Phil Young	76de981574	napatech: Added comment indicating that hba will be deprecated ... HBA will be deprecated in Suricata 7	6 years ago
Jeff Lucovsky	06f41f608c	doc: Improve grammar, spelling and clarifications ... This commit improves the overall documentation's grammar, spelling, and adds clarifications where needed.	6 years ago
Odin Jenseg	4549505418	doc/userguide: fix outdated xdp info	6 years ago
Jeff Lucovsky	b116a56a32	doc: Correct typos	6 years ago
Jeff Lucovsky	e14447d594	docs/napatech: Correct typo	7 years ago
Phil Young	3fbcacf9a8	napatech: documentation hardware based bypass support ... Napatech hardware bypass support enables Suricata to utilize capabilities of Napatech SmartNICs to selectively bypass flow-based traffic.	7 years ago
Eric Leblond	82eb669205	doc: information about scaling AF_PACKET IPS mode	7 years ago
Eric Leblond	35bc73e4e2	doc: change eBPF directory path	7 years ago
Eric Leblond	cc28d24e9a	doc: install eBPF files in share directory ... Following proposal by Sascha Steinbiss, let's use /usr/share/suricata to store the eBPF files.	7 years ago
Eric Leblond	3cf49ae868	doc: fix English and some typos	7 years ago
Eric Leblond	4be6701836	doc: pointer to bpfctrl ... As bpfctrl is currently the easiest way to manage pinned maps, let's point to it. We will switch doc to suricatacl once support has been added.	7 years ago
Eric Leblond	8f1a7de791	doc: improve doc on compiling with eBPF support	7 years ago
Eric Leblond	f1ab27b7cb	doc: improve XDP cpu redirect documentation	7 years ago
Eric Leblond	6d9ac64f7b	doc: only balance by ip pair ... As there is some issue with defrag, let's recommend to only do IP pair load-balacing for RSS	7 years ago
Eric Leblond	a1d3835b86	doc: document filter.bpf changes ... Also adds some info to explain maps.	7 years ago
Hilko Bengen	36998ab4cd	Add documentation for --with-clang parameter	7 years ago
Eric Leblond	1f151dd8a6	doc: address norg comments on eBPF doc	7 years ago
Eloïse Brocas	8692aac97f	doc: specify config file in ebpf doc ... This patch updates the ebpf-xdp.rst file to specify which configuration file has to be modified.	7 years ago
Eric Leblond	eea3c6b610	doc: info for new bypass counters	7 years ago
Eric Leblond	e3dccb2400	doc: update bypass stats doc	7 years ago
Eric Leblond	8a11581ac8	doc: update ebpf doc following bypass_filter change	7 years ago
Eric Leblond	253c011c70	doc: update for latest xdp_filter.c change	7 years ago
Eric Leblond	567b5ee1bc	af-packet: rename option 'no-percpu-hash'	7 years ago
Eric Leblond	ca50f8852e	doc: improve ebpf doc ... Add example of bypass rules and explain clang dependency.	7 years ago
Eric Leblond	c11eb78141	doc: document netronome hardware bypass usage	7 years ago
Eric Leblond	82c4f5135b	doc: use github mirror to setup libbpf	7 years ago
Eric Leblond	1c4d214cdb	doc: typo fixes on ebpf doc	7 years ago